Observability and logs
Audit logs
Audit logs provide a log of events across your organization, such as creating or deleting a repository, or modifications to repository settings/configuration.
Cloudsmith retains audit logs for 1 year. Your plan level determines how far back you can review and search audit logs.
| Plan | Audit log review period |
|---|---|
| Pro | Last 30 days |
| Ultra | Last 60 days |
| Enterprise | Custom, up to 1 year To update your audit log review period, please reach out to your customer success manager. |
Key concepts
Clicking on a row in your audit log will expand to show more details.
Each entry in the log represents an event or a state change and consists of four main components.
- Actor: The object that performed the Action, such as a User, Service Account or System
- Verb: The verb (phrase) identifying "what_happened", such as
login,retention_settings_changedortoken_created - Action Object: The object which was created, deleted or updated by the action.
- Target: (Optional) The object within which the Action was performed, such as a repository or account
Searching / filtering
You can Search and Filter the Audit Log using the search box at the top. You can also use boolean logic (e.g. AND/OR/NOT) for complex search queries.
Search terms
| Search By | Search Terms Example |
|---|---|
| Actor | actor:some-user |
| Actor Kind | actor_kind:user (user) actor_kind:service_account (service account) actor_kind:system |
| Event Time | event_at:>"1 day ago" event_at:<"June 21, 2022 EST" |
| Event Kind | event_kind:action (action) event_kind:create (create) event_kind:read (read) event_kind:update (update) event_kind:delete (delete) |
| Event (Fuzzy) | event:api_key (api key events) event:entitlement (entitlement events) event:login (login events) event:package (package events) event:retention (retention events) event:service_account (service account events) |
Field type modifiers (depending on the type, you can influence behaviour)
-
For all queries, you can use:
~foofor negation -
For string queries, you can use:
^footo anchor to start of term
foo$to anchor to end of term
foo*barfor fuzzy matching -
For number/date queries, you can use:
>foofor values greater than
>=foofor values greater / equal
<foofor values less than
<=foofor values less / equal
🔐 Audit log event types (user and organization)
Cloudsmith tracks a wide range of user and organization-level activities. The following audit events help you monitor security, access control, policy enforcement, and team collaboration across your organization.
| Event | Identifier | Description | Content Type |
|---|---|---|---|
| API Token Exposed | action.api_key_exposed | An API token has been exposed. | System |
| API Token Refreshed | update.api_key_refreshed | A user refreshed their API token. | User |
| API Token Refresh Enforced | update.api_key_enforced_refresh | An API token refresh was enforced. | User |
| API Token Expiry Notified | action.api_key_expiring_soon | User notified of upcoming API token expiration. | User |
| API Token Expired Notified | action.api_key_expired | User notified that their API token has expired. | User |
| Password Updated | update.password | User password was updated. | User |
| User Login | action.login | User successfully logged in. | User |
| Service Created | create.service | Created a new service user. | User |
| Service Deleted | delete.service | Deleted a service user. | User |
| Service Key Refreshed | update.service_key_refreshed | Refreshed the key for a service user. | User |
| User Deactivated | delete.user | A user account was deactivated. | User |
| User Restored | action.user_restored | A previously deactivated user account was restored. | User |
| Member Invited | create.member_invited_to_org | Invited a new member to the organization. | Org |
| Invitation Canceled | delete.member_invitation_canceled | Canceled an organization invitation. | Org |
| Invitation Extended | update.member_invitation_extended | Extended an existing invitation. | Org |
| Invitation Accepted | create.member_invitation_accepted | A user accepted an organization invitation. | Org |
| Member Added | create.org_membership_added | A user was added to the organization. | Org |
| Member Removed | delete.org_membership_removed | A user was removed from the organization. | Org |
| Member Role Changed | update.org_membership_role_changed | Updated a member's role within the organization. | Org |
| OIDC Settings Created | create.open_id_connect_provider_settings_created | Created OpenID Connect (OIDC) settings. | Org |
| OIDC Settings Updated | update.open_id_connect_provider_settings_updated | Updated OIDC settings. | Org |
| OIDC Settings Deleted | delete.open_id_connect_provider_settings_deleted | Deleted OIDC settings. | Org |
| Organization Deleted | delete.org_deleted | Deleted an organization. | Org |
| Organization Renamed | update.org_renamed | Renamed an organization. | Org |
| Package Delivery On-Demand Limit Updated | update.org_bandwidth_ondemand_limit_updated | Updated the on-demand package delivery (bandwidth) limit for the workspace. | Org |
| Artifact Data On-Demand Limit Updated | update.org_storage_ondemand_limit_updated | Updated the on-demand artifact data (storage) limit for the workspace. | Org |
| Repo Creation Enabled | update.create_repos_enabled | Enabled repository creation in the organization. | Org |
| Repo Creation Disabled | update.create_repos_disabled | Disabled repository creation. | Org |
| Team Creation Enabled | update.create_teams_enabled | Enabled creation of new teams. | Org |
| Team Creation Disabled | update.create_teams_disabled | Disabled creation of new teams. | Org |
| Invite Collaborators Enabled | update.invite_collaborators_enabled | Enabled collaborator invites. | Org |
| Invite Collaborators Disabled | update.invite_collaborators_disabled | Disabled collaborator invites. | Org |
| Invite Users Enabled | update.invite_users_enabled | Enabled user invites. | Org |
| Invite Users Disabled | update.invite_users_disabled | Disabled user invites. | Org |
| Unredacted Email View Enabled | update.view_unredacted_emails_enabled | Enabled viewing member emails without redaction. | Org |
| Unredacted Email View Disabled | update.view_unredacted_emails_disabled | Disabled viewing member emails without redaction. | Org |
| SCIM Provisioning Allowed | update.scim_allowed | Allowed SCIM provisioning. | Org |
| SCIM Provisioning Blocked | update.scim_blocked | Blocked SCIM provisioning. | Org |
| SAML Login Enabled | update.saml_enabled | Enabled SAML-based login. | Org |
| SAML Login Disabled | update.saml_disabled | Disabled SAML-based login. | Org |
| SAML Enforce Enabled | update.saml_enforce_enabled | Enforced SAML login for all users. | Org |
| SAML Enforce Disabled | update.saml_enforce_disabled | Disabled SAML enforcement. | Org |
| SAML Group Sync Enabled | update.saml_group_sync_enabled | Enabled SAML group synchronization. | Org |
| SAML Group Sync Disabled | update.saml_group_sync_disabled | Disabled SAML group synchronization. | Org |
| Enforce 2FA Enabled | update.enforce_2fa_enabled | Enforced Two-Factor Authentication. | Org |
| Enforce 2FA Disabled | update.enforce_2fa_disabled | Disabled 2FA enforcement. | Org |
| License Policy Created | create.package_license_policy_created | Created a package license policy. | Org |
| License Policy Updated | update.package_license_policy_updated | Updated a package license policy. | Org |
| License Policy Deleted | delete.package_license_policy_deleted | Deleted a package license policy. | Org |
| Vulnerability Policy Created | create.package_vulnerability_policy_created | Created a vulnerability policy. | Org |
| Vulnerability Policy Updated | update.package_vulnerability_policy_updated | Updated a vulnerability policy. | Org |
| Vulnerability Policy Deleted | delete.package_vulnerability_policy_deleted | Deleted a vulnerability policy. | Org |
| Vulnerability Policy Quarantine Enabled | update.package_vulnerability_policy_quarantine_enabled | Enabled quarantine on a vulnerability policy. | Org |
| Vulnerability Policy Quarantine Disabled | update.package_vulnerability_policy_quarantine_disabled | Disabled quarantine on a vulnerability policy. | Org |
| API Key Policy Created | create.org_api_key_rule_created | Created an API key policy. | Org |
| API Key Policy Deleted | delete.org_api_key_rule_deleted | Deleted an API key policy. | Org |
| API Key Auto-Refresh Enabled | update.org_api_key_rule_refresh_enabled | Enabled automatic API key refresh. | Org |
| API Key Auto-Refresh Disabled | update.org_api_key_rule_refresh_disabled | Disabled automatic API key refresh. | Org |
| API Key Max Age Updated | update.org_api_key_rule_max_age_changed | Changed maximum allowed API key age. | Org |
| Package Deny Policy Created | create.package_deny_policy_created | Created a package deny policy. | Org |
| Package Deny Policy Updated (Name) | update.package_deny_policy_name_updated | Updated deny policy name. | Org |
| Package Deny Policy Updated (Desc) | update.package_deny_policy_description_updated | Updated deny policy description. | Org |
| Package Deny Policy Updated (Query) | update.package_deny_policy_query_updated | Updated deny policy query. | Org |
| Package Deny Policy Enabled | update.package_deny_policy_enabled | Enabled a deny policy. | Org |
| Package Deny Policy Disabled | update.package_deny_policy_disabled | Disabled a deny policy. | Org |
| Package Deny Policy Deleted | delete.package_deny_policy_deleted | Deleted a deny policy. | Org |
| Team Created | create.team_created | Created a team. | Org |
| Team Deleted | delete.team_deleted | Deleted a team. | Org |
| Team Renamed | update.team_renamed | Renamed a team. | Org |
| Team Slug Renamed | update.team_renamed_slug | Changed the team’s slug. | Org |
| Added to Team | create.team_membership_added | Added a user to a team. | Org |
| Removed from Team | delete.team_membership_removed | Removed a user from a team. | Org |
| Team Role Changed | update.team_membership_role_changed | Updated a team member’s role. | Org |
🔐 Audit log event types (repository)
The following events are logged for repository-level actions, including package changes, key management, entitlement tokens, retention rules, Geo/IP rules, and more.
Webhook events record the webhook ID and its target URL. Webhook secrets, signature keys and any credentials embedded in the URL are never written to the audit log.
| Event | Identifier | Description | Content Type |
|---|---|---|---|
| Repository Created | create.repository_created | Created a new repository. | Repo |
| Repository Deleted | delete.repository_deleted | Deleted a repository. | Repo |
| EULA Enforcement Enabled | update.eula_enforcement_enabled | Enabled EULA enforcement on a repository. | Repo |
| EULA Enforcement Disabled | update.eula_enforcement_disabled | Disabled EULA enforcement on a repository. | Repo |
| Retention Rules Enabled | update.retention_enabled | Enabled retention rules on a repository. | Repo |
| Retention Rules Disabled | update.retention_disabled | Disabled retention rules on a repository. | Repo |
| Retention Days Updated | update.retention_days | Updated 'limit by days' rule for retention. | Repo |
| Retention Count Updated | update.retention_count_limit | Updated 'limit by count' rule for retention. | Repo |
| Retention Size Updated | update.retention_size_limit | Updated 'limit by size' rule for retention. | Repo |
| Retention Group by Name Updated | update.retention_group_by_name | Updated retention rule to group by package name. | Repo |
| Retention Group by Format Updated | update.retention_group_by_backend | Updated retention rule to group by package format. | Repo |
| Retention Group by Type Updated | update.retention_group_by_type | Updated retention rule to group by package type. | Repo |
| Storage Region Updated | update.storage_region_updated | Changed the storage region of a repository. | Repo |
| Verify Signatures Enabled | update.verify_signatures_enabled | Enabled signature verification for packages. | Repo |
| Verify Signatures Disabled | update.verify_signatures_disabled | Disabled signature verification for packages. | Repo |
| Hidden from Public Listings | update.public_hidden_enabled | Hid the repository from public repository listings. | Repo |
| Shown in Public Listings | update.public_hidden_disabled | Showed the repository in public repository listings. | Repo |
| File Indexing Enabled | update.index_files_enabled | Enabled indexing of files contained in packages. | Repo |
| File Indexing Disabled | update.index_files_disabled | Disabled indexing of files contained in packages. | Repo |
| Vulnerability Scanning Enabled | update.vulnerability_scanning_enabled | Enabled vulnerability scanning on a repository. | Repo |
| Vulnerability Scanning Disabled | update.vulnerability_scanning_disabled | Disabled vulnerability scanning on a repository. | Repo |
| Geo/IP Restrictions Enabled | update.geoip_enabled | Enabled Geo/IP restrictions on a repository. | Repo |
| Geo/IP Restrictions Disabled | update.geoip_disabled | Disabled Geo/IP restrictions on a repository. | Repo |
| Geo/IP Country Deny List Updated | update.geoip_country_deny_list | Updated the country deny list. Records the previous and new list. | Repo |
| Geo/IP Country Allow List Updated | update.geoip_country_allow_list | Updated the country allow list. Records the previous and new list. | Repo |
| Geo/IP IP/CIDR Deny List Updated | update.geoip_ip_deny_list | Updated the IP/CIDR deny list. Records the previous and new list. | Repo |
| Geo/IP IP/CIDR Allow List Updated | update.geoip_ip_allow_list | Updated the IP/CIDR allow list. Records the previous and new list. | Repo |
| Entitlement Tokens Synced | action.entitlement_token_sync | Synced entitlement tokens for the repository. | Repo |
| Cache Rule Created | create.repository_cache_rule_created | Created a new edge cache rule. | Repo |
| Cache Rule Deleted | delete.repository_cache_rule_deleted | Deleted an edge cache rule. | Repo |
| Cache Metadata TTL Updated | update.repository_cache_rule_dynamic_ttl_updated | Updated metadata TTL for edge caching. | Repo |
| Cache Storage TTL Updated | update.repository_cache_rule_metadata_ttl_updated | Updated package TTL for edge caching. | Repo |
| Entitlement Token Created | create.entitlement_created | Created an entitlement token. | Repo |
| Entitlement Token Deleted | delete.entitlement_deleted | Deleted an entitlement token. | Repo |
| Entitlement Token Enabled | update.entitlement_enabled | Enabled an entitlement token. | Repo |
| Entitlement Token Disabled | update.entitlement_disabled | Disabled an entitlement token. | Repo |
| Entitlement Token Secret Updated | update.entitlement_secret_updated | Updated the secret for an entitlement token. | Repo |
| EULA Revision Created | create.eula_revision_created | Created a new EULA revision. | Repo |
| EULA Revision Deleted | delete.eula_revision_deleted | Deleted a EULA revision. | Repo |
| EULA Content Updated | update.eula_content_updated | Updated the content of a EULA revision. | Repo |
| EULA Identifier Updated | update.eula_identifier_updated | Updated the identifier of a EULA revision. | Repo |
| GPG Key Created | create.repository_gpg_key_created | Created a GPG key for the repository. | Repo |
| GPG Key Deleted | delete.repository_gpg_key_deleted | Deleted a GPG key from the repository. | Repo |
| GPG Key Enabled | update.repository_gpg_key_enabled | Enabled a GPG key. | Repo |
| GPG Key Disabled | update.repository_gpg_key_disabled | Disabled a GPG key. | Repo |
| GPG Key Set as Default | update.repository_gpg_key_is_default | Set a GPG key as the default for signing. | Repo |
| RSA Key Created | create.repository_rsa_key_created | Created an RSA key for the repository. | Repo |
| RSA Key Deleted | delete.repository_rsa_key_deleted | Deleted an RSA key from the repository. | Repo |
| RSA Key Enabled | update.repository_rsa_key_enabled | Enabled an RSA key. | Repo |
| RSA Key Disabled | update.repository_rsa_key_disabled | Disabled an RSA key. | Repo |
| RSA Key Set as Default | update.repository_rsa_key_is_default | Set an RSA key as the default for signing. | Repo |
| Signature Key Created | create.repository_sig_key_created | Created a signature key. | Repo |
| Signature Key Deleted | delete.repository_sig_key_deleted | Deleted a signature key. | Repo |
| Signature Key Type Changed | update.repository_sig_key_type_changed | Changed the type of a repository signature key. | Repo |
| Upstream Created | create.upstream_created | Created an upstream for the repository. | Repo |
| Upstream Deleted | delete.upstream_deleted | Deleted an upstream from the repository. | Repo |
| Upstream Enabled | update.upstream_enabled | Enabled an upstream. | Repo |
| Upstream Disabled | update.upstream_disabled | Disabled an upstream. | Repo |
| Upstream Name Updated | update.upstream_name | Updated the name of an upstream. | Repo |
| Upstream URL Updated | update.upstream_url | Updated the URL of an upstream. | Repo |
| Upstream Mode Updated | update.upstream_mode | Updated the mode (proxy or cache) of an upstream. | Repo |
| Upstream Priority Updated | update.upstream_priority | Updated the priority of an upstream. | Repo |
| Upstream SSL Verification Enabled | update.upstream_ssl_verification_enabled | Enabled SSL verification for an upstream. | Repo |
| Upstream SSL Verification Disabled | update.upstream_ssl_verification_disabled | Disabled SSL verification for an upstream. | Repo |
| Upstream Authentication Updated | update.upstream_authentication | Updated authentication for an upstream (credentials are never recorded). | Repo |
| Webhook Created | create.webhook_created | Created a webhook. Records the webhook ID and target URL. | Repo |
| Webhook Deleted | delete.webhook_deleted | Deleted a webhook. Records the webhook ID, target URL and subscribed events. | Repo |
| Webhook Enabled | update.webhook_enabled | Enabled a webhook. | Repo |
| Webhook Disabled | update.webhook_disabled | Disabled a webhook. Records the reason. A disable caused by delivery failures is logged as a system action. | Repo |
| Webhook URL Updated | update.webhook_url | Updated the target URL of a webhook. Records the previous and new URL. | Repo |
| Webhook Subscriptions Updated | update.webhook_subscriptions | Updated the events a webhook subscribes to. Records the previous and new event lists. | Repo |
